{"id":"CVE-2017-7957","aliases":["DEBIAN-CVE-2017-7957","DLA-930-1","DSA-3841-1","EUVD-2020-0471","GHSA-7hwc-46rm-65jh","SUSE-RU-2019:1006-1","SUSE-SU-2017:3389-1","SUSE-SU-2017:3390-1","SUSE-SU-2019:1006-1","UBUNTU-CVE-2017-7957","openSUSE-SU-2024:10592-1"],"status":"published","title":"Denial of service in XStream","description":"XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML(\"\u003cvoid/\u003e\") call.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04928,"percentile":0.92189,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2017-04-29T19:00:00Z","modified":"2026-11-03T02:45:07Z","fixes":[{"ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","fixed_in":["1.4.10"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libxstream-java","fixed_in":["1.4.9-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxstream-java","fixed_in":["1.4.9-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxstream-java","fixed_in":["1.4.9-2"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"libxstream-java","fixed_in":["1.4.2-1+deb7u2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"libxstream-java","fixed_in":["1.4.7-2+deb8u2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.2","package":"spacewalk-backend","fixed_in":["2.8.57.14-3.25.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.2","package":"spacewalk-certs-tools","fixed_in":["2.8.8.7-3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 3.2","package":"spacewalk-web","fixed_in":["2.8.7.15-3.24.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"apache-commons-lang3","fixed_in":["3.4-3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"cobbler","fixed_in":["2.6.6-6.16.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"drools","fixed_in":["7.17.0-3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"guava","fixed_in":["27.0.1-3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"jade4j","fixed_in":["1.0.7-3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"kie-api","fixed_in":["7.17.0-3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"kie-soup","fixed_in":["7.17.0.Final-2.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"optaplanner","fixed_in":["7.17.0-3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"py26-compat-salt","fixed_in":["2016.11.10-6.21.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"reprepro","fixed_in":["5.3.0-2.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"smdba","fixed_in":["1.6.4-0.3.9.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"spacecmd","fixed_in":["2.8.25.10-3.20.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-admin","fixed_in":["2.8.4.4-3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-backend","fixed_in":["2.8.57.14-3.25.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-branding","fixed_in":["2.8.5.15-3.19.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-certs-tools","fixed_in":["2.8.8.7-3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-java","fixed_in":["2.8.78.21-3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-web","fixed_in":["2.8.7.15-3.24.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"subscription-matcher","fixed_in":["0.23-4.12.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"susemanager","fixed_in":["3.2.17-3.22.4"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-schema","fixed_in":["3.2.18-3.22.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-sls","fixed_in":["3.2.23-3.26.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-sync-data","fixed_in":["3.2.14-3.20.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.2","package":"xstream","fixed_in":["1.4.10-4.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"xstream","fixed_in":["1.4.9-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.1","package":"xstream","fixed_in":["1.4.9-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libxstream-java","fixed_in":["1.4.7-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libxstream-java","fixed_in":["1.4.8-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.9-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.9-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.9-2"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-1+deb7u2"}]}],"versions":["1.4.2-1","1.4.2-1+deb7u1"]},{"source":"osv","ecosystem":"Debian:8","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-2+deb8u2"}]}],"versions":["1.4.7-2","1.4.7-2+deb8u1"]},{"source":"osv","ecosystem":"Maven","package":"com.thoughtworks.xstream:xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.10"}]}],"versions":["0.1","0.2","0.3","0.5","0.6","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.1.3","1.2","1.2.1","1.2.2","1.3","1.3.1","1.4","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.57.14-3.25.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.2","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.8.7-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7.15-3.24.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-6.16.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"drools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.17.0-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.0.1-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"jade4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"kie-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.17.0-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"kie-soup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.17.0.Final-2.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"optaplanner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.17.0-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-6.21.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"reprepro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-2.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"smdba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-0.3.9.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.25.10-3.20.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4.4-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.57.14-3.25.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-branding","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5.15-3.19.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.8.7-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.78.21-3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7.15-3.24.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"subscription-matcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23-4.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.17-3.22.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.18-3.22.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.23-3.26.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.14-3.20.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.10-4.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.9-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.1","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.9-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.57.14-3.25.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.2","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.8.7-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 3.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7.15-3.24.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"apache-commons-lang3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-6.16.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"drools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.17.0-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.0.1-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"jade4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"kie-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.17.0-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"kie-soup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.17.0.Final-2.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"optaplanner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.17.0-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-6.21.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"reprepro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.0-2.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"smdba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-0.3.9.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.25.10-3.20.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4.4-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.57.14-3.25.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-branding","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5.15-3.19.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.8.7-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.78.21-3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.7.15-3.24.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"subscription-matcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23-4.12.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.17-3.22.4"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.18-3.22.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.23-3.26.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.14-3.20.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.2","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.10-4.3.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1ubuntu0.1"}]}],"versions":["1.4.4-1","1.4.7-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxstream-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1ubuntu0.1"}]}],"versions":["1.4.8-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.18-1.1"}]}],"bundled":22}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"redhat","product":"fuse"},{"vendor":"redhat","product":"jboss_middleware"},{"vendor":"xstream","product":"xstream"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:2888","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1832","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2889","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securitytracker.com/id/1039499","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://www-prd-trops.events.ibm.com/node/715749","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Permissions Required","report","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/125800","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://www.debian.org/security/2017/dsa-3841","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://x-stream.github.io/CVE-2017-7957.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/100687","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7957","tags":["advisory"]},{"url":"https://github.com/x-stream/xstream/commit/6e546ec366419158b1e393211be6d78ab9604ab","tags":["web"]},{"url":"https://github.com/x-stream/xstream/commit/8542d02d9ac5d384c85f4b33d6c1888c53bd55d","tags":["web"]},{"url":"https://github.com/x-stream/xstream/commit/b3570be2f39234e61f99f9a20640756ea71b1b4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7hwc-46rm-65jh"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-7957","tags":["advisory"]},{"url":"https://github.com/x-stream/xstream","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/-2019-1006/suse-ru-20191006-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1070731","tags":["report"]},{"url":"https://bugzilla.suse.com/1109316","tags":["report"]},{"url":"https://bugzilla.suse.com/1120242","tags":["report"]},{"url":"https://bugzilla.suse.com/1121195","tags":["report"]},{"url":"https://bugzilla.suse.com/1122230","tags":["report"]},{"url":"https://bugzilla.suse.com/1122381","tags":["report"]},{"url":"https://bugzilla.suse.com/1122837","tags":["report"]},{"url":"https://bugzilla.suse.com/1124290","tags":["report"]},{"url":"https://bugzilla.suse.com/1125600","tags":["report"]},{"url":"https://bugzilla.suse.com/1125744","tags":["report"]},{"url":"https://bugzilla.suse.com/1126075","tags":["report"]},{"url":"https://bugzilla.suse.com/1126099","tags":["report"]},{"url":"https://bugzilla.suse.com/1126518","tags":["report"]},{"url":"https://bugzilla.suse.com/1127542","tags":["report"]},{"url":"https://bugzilla.suse.com/1128228","tags":["report"]},{"url":"https://bugzilla.suse.com/1128724","tags":["report"]},{"url":"https://bugzilla.suse.com/1128781","tags":["report"]},{"url":"https://bugzilla.suse.com/1129765","tags":["report"]},{"url":"https://bugzilla.suse.com/1129851","tags":["report"]},{"url":"https://bugzilla.suse.com/1129956","tags":["report"]},{"url":"https://bugzilla.suse.com/1130658","tags":["report"]},{"url":"https://bugzilla.suse.com/1131490","tags":["report"]},{"url":"https://bugzilla.suse.com/1131677","tags":["report"]},{"url":"https://bugzilla.suse.com/1131721","tags":["report"]},{"url":"https://bugzilla.suse.com/1132579","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7957","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173389-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173390-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191006-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-7957","tags":["report"]},{"url":"https://x-stream.github.io/CVE-2017-7957.html","tags":["report"]},{"url":"https://github.com/x-stream/xstream/commit/b3570be","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7957","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39153","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-7957","description":"XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML(\"\u003cvoid/\u003e\") call.","status":"published","published":"2017-04-29T19:00:00Z","modified":"2026-10-08T21:03:12.371Z","updated_at":"2026-11-02T14:33:20.843976Z"}],"euvd":[{"id":"EUVD-2020-0471","description":"XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML(\"\u003cvoid/\u003e\") call.","status":"published","published":"2017-04-29T19:00:00Z","modified":"2026-10-08T21:03:12Z","updated_at":"2026-11-02T17:27:27.240961Z"}],"ghsa":[{"id":"GHSA-7hwc-46rm-65jh","title":"Denial of service in XStream","description":"XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML(\"\u003cvoid/\u003e\") call.","status":"published","published":"2020-06-30T22:48:24Z","modified":"2025-05-23T19:00:18Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:38:44.991725Z"}],"nvd":[{"id":"CVE-2017-7957","description":"XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML(\"\u003cvoid/\u003e\") call.","status":"published","published":"2017-04-29T19:59:00.167Z","modified":"2026-10-08T21:17:05.933Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:47.848196Z"}],"osv":[{"id":"CVE-2017-7957","description":"XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML(\"\u003cvoid/\u003e\") call.","status":"published","published":"2017-04-29T19:59:00.167Z","modified":"2026-11-03T02:45:07.07535865Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T03:05:43.703218Z"},{"id":"DEBIAN-CVE-2017-7957","description":"XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML(\"\u003cvoid/\u003e\") call.","status":"published","published":"2017-04-29T19:59:00.167Z","modified":"2026-10-09T09:47:31.574610061Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"GHSA-7hwc-46rm-65jh","title":"Denial of service in XStream","description":"XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML(\"\u003cvoid/\u003e\") call.","status":"published","published":"2020-06-30T22:48:24Z","modified":"2025-05-23T19:46:57.847104Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"UBUNTU-CVE-2017-7957","description":"XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML(\"\u003cvoid/\u003e\") call.","status":"published","published":"2017-04-29T19:59:00Z","modified":"2025-07-16T07:02:15.466661Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"DLA-930-1","title":"libxstream-java - security update","status":"published","published":"2017-05-01T00:00:00Z","modified":"2026-03-09T02:10:39.971153Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"DSA-3841-1","title":"libxstream-java - security update","status":"published","published":"2017-05-02T00:00:00Z","modified":"2026-03-09T01:21:48.790523Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"openSUSE-SU-2024:10592-1","title":"xstream-1.4.18-1.1 on GA media","description":"These are all security issues fixed in the xstream-1.4.18-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:40:43.193438Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-RU-2019:1006-1","title":"Security update for SUSE Manager Server 3.2","description":"\nThis update includes the following new features:\n\n  to the repository metadata (fate#325676)\n\nThis update fixes the following issues:\n\napache-commons-lang3:\n\n- Run fdupes on javadoc\n- Specify java target and source level 1.6\n  to make package compatible with JDK \u003e= 1.8\n\ncobbler:\n\n- Fixes case where distribution detection returns None (bsc#1130658)\n- SUSE texmode fix (bsc#1109316)\n\ndrools:\n\n- Update Drools to 7.17.0\n- Release Notes: https://issues.jboss.org/secure/ReleaseNote.jspa\n- Fixes for SLE 15 compatibility \n\nguava:\n\n- Updated from 13.0.1 to 27.0.1\n- Changes between 13.0.1 and 23.0:\n  https://github.com/google/guava/wiki/Release14\n  https://github.com/google/guava/wiki/Release15\n  https://github.com/google/guava/wiki/Release16\n  https://github.com/google/guava/wiki/Release17\n  https://github.com/google/guava/wiki/Release18\n  https://github.com/google/guava/wiki/Release19\n  https://github.com/google/guava/wiki/Release23\n- Changes between 23.0 and 27.0.1:\n  see https://github.com/google/guava/releases\n\njade4j:\n\n- Conditional java/java-devel requires based on os version \n- Update dependency version for commons-lang3 to 3.4\n- Fix building javadoc\n\nkie-api:\n\n- Update KIE to 7.17.0 \n- Release notes: https://issues.jboss.org/secure/ReleaseNote.jspa\n\noptaplanner:\n\n- Update Optaplanner to 7.17.0\n\npy26-compat-salt:\n\n- Fix minion arguments assign via sysctl (bsc#1124290)\n\nsmdba:\n\n- Make 'smdba space-overview' postgresql version\n  agnostic (bsc#1129956)\n- Fix version mismatch\n\nspacecmd:\n\n- Fix system_delete with SSM (bsc#1125744)\n\nspacewalk-admin:\n\n- Fix encoding bug in salt event processing (bsc#1129851)\n\nspacewalk-backend:\n\n- Fix linking of packages in reposync (bsc#1131677)\n- Fix: handle non-standard filenames for comps.xml (bsc#1120242)\n- Mgr-sign-metadata can optionally clear-sign metadata files\n\nspacewalk-branding:\n\n- Introduce a description label for the new 'minion-checkin' Taskomatic job (bsc#1122837)\n\nspacewalk-certs-tools:\n\n- Add support for Ubuntu to bootstrap script\n- Clean up downloaded gpg keys after bootstrap (bsc#1126075)\n\nspacewalk-java:\n\n- Fix base channel selection for Ubuntu systems (bsc#1132579)\n- Fix retrieval of build time for .deb repositories (bsc#1131721)\n- Allow access to susemanager tools channels without res subscription (bsc#1127542)\n- Add support for SLES 15 live patches in CVE audit\n- Add a Taskomatic job to perform minion check-in regularly, drop use of Salt's Mine (bsc#1122837)\n- Fix errata_details to return details correctly (bsc#1128228)\n- Support ubuntu products and debian architectures in mgr-sync\n- Adapt check for available repositories to debian style repositories\n- Add support for custom username when bootstrapping with Salt-SSH\n- Read and update running kernel release value at each startup of minion (bsc#1122381)\n- Add error message on sync refresh when there are no scc credentials\n- Fix apidoc issues \n- Fix deleting server when minion_formulas.json is empty (bsc#1122230)\n- Minion-action-cleanup Taskomatic task: do not clean actions younger than one hour\n- Schedule full package refresh only once per action chain if needed (bsc#1126518)\n- Check and schedule package refresh in response to events independently of what originates them (bsc#1126099)\n- Add configuration option to limit the number of changelog entries added\n  to the repository metadata (fate#325676)\n- Generate InRelease file for Debian/Ubuntu repos when metadata signing is enabled\n\nspacewalk-web:\n\n- Show undetected subscription-matching message object as a string anyway (bsc#1125600)\n- Fix action scheduler time picker prefill when the server is on  'UTC/GMT' timezone (bsc#1121195)\n- Allow username input on bootstrap page when using Salt-SSH\n- Add cache buster for static files (js/css) to fix caching issues after upgrading.\n\nsubscription-matcher:\n\n- Update dependencies (Drools, Optaplanner, Guava, Xstream)\n- Make the java and java-devel requirements variable\n- Relax the requirement condition on apache-commons-lang3\n\nsusemanager:\n\n- Support creating bootstrap repos for Ubuntu 18.04 and 16.04.\n- Allow alternative names for bootstrap packages, to allow\n  using old client tools after package renames\n- Feat: create Ubuntu empty repository\n- Fix creation of bootstrap repositories for SLE12 (no SP) by\n  requiring python-setuptools only for SLE12 \u003e= SP1 (bsc#1129765)\n- Add bootstrap repo definition for SLE15 SP1\n\nsusemanager-docs_en:\n\n- Update text and image files.\n- Fix bad link.\n- Update Manual Backup and smdba sections.\n- Troubleshooting Salt clients.\n- Fix package endpoint in salt pillar content.\n- Ubuntu Clients supported.\n- Change License to GFL 1.2, as it is the real license for the doc\n  since 3.2.0\n\nsusemanager-schema:\n\n- Add a Taskomatic job to perform minion check-in regularly, drop use of Salt's Mine (bsc#1122837)\n- Fix performance regression in inter-server-sync (bsc#1128781)\n- Set minion-action-cleanup run frequency from hourly to daily at midnight\n\nsusemanager-sls:\n\n- Update get_kernel_live_version module to support older Salt versions (bsc#1131490)\n- Update get_kernel_live_version module to support SLES 15 live patches\n- Do not configure Salt Mine in newly registered minions (bsc#1122837)\n- Fix Salt error related to remove_traditional_stack when bootstrapping an Ubuntu\n  minion (bsc#1128724)\n- Automatically trust SUSE GPG key for client tools channels on Ubuntu systems\n- Util.systeminfo sls has been added to perform different actions at minion startup(bsc#1122381) \n\nsusemanager-sync-data:\n\n- Allow access to susemanager tools channels without res subscription (bsc#1127542)\n- Add Ubuntu product definitions\n- Adapt to SCC changes\n- Add CaaSP 4 Toolchain\n\nxstream:\n\n- Update xstream to 1.4.10\n- Major changes:\n- CVE-2017-7957: XStream could cause a Denial of Service when unmarshalling void. (bsc#1070731)\n- New XStream artifact with -java7 appended as version suffix for a library explicitly without the Java 8 stuff (lambda expression support, converters for java.time.* package).\n- Improve performance by minimizing call stack of mapper chain.\n- XSTR-774: Add converters for types of java.time, java.time.chrono, and java.time.temporal packages (converters for LocalDate, LocalDateTime, LocalTime, OffsetDateTime, and ZonedDateTime by Matej Cimbora).\n- JavaBeanConverter does not respect ignored unknown elements.\n- Add XStream.setupDefaultSecurity to initialize security framework with defaults of XStream 1.5.x.\n- Emit error warning if security framework has not been initialized and the XStream instance is vulnerable to known exploits.\n- Feat: modify patch to be compatible with JDK 11 building\n- Fixes for SLE 15 compatibility\n\n","status":"published","published":"2019-04-24T10:06:34Z","modified":"2026-02-04T04:37:11.114403Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2017:3389-1","title":"Security update for xstream","description":"This update for xstream fixes the following issues:\n\n- CVE-2017-7957: XStream could cause a Denial of Service when unmarshalling void. (bsc#1070731)\n","status":"published","published":"2017-12-20T16:03:16Z","modified":"2026-02-04T03:46:28.876368Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2017:3390-1","title":"Security update for xstream","description":"This update for xstream fixes the following issues:\n\n- CVE-2017-7957: XStream could cause a Denial of Service when unmarshalling void. (bsc#1070731)\n","status":"published","published":"2017-12-20T16:33:12Z","modified":"2026-02-04T03:18:56.223131Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2019:1006-1","title":"Security update for SUSE Manager Server 3.2","description":"\nThis update includes the following new features:\n\n  to the repository metadata (fate#325676)\n\nThis update fixes the following issues:\n\napache-commons-lang3:\n\n- Run fdupes on javadoc\n- Specify java target and source level 1.6\n  to make package compatible with JDK \u003e= 1.8\n\ncobbler:\n\n- Fixes case where distribution detection returns None (bsc#1130658)\n- SUSE texmode fix (bsc#1109316)\n\ndrools:\n\n- Update Drools to 7.17.0\n- Release Notes: https://issues.jboss.org/secure/ReleaseNote.jspa\n- Fixes for SLE 15 compatibility \n\nguava:\n\n- Updated from 13.0.1 to 27.0.1\n- Changes between 13.0.1 and 23.0:\n  https://github.com/google/guava/wiki/Release14\n  https://github.com/google/guava/wiki/Release15\n  https://github.com/google/guava/wiki/Release16\n  https://github.com/google/guava/wiki/Release17\n  https://github.com/google/guava/wiki/Release18\n  https://github.com/google/guava/wiki/Release19\n  https://github.com/google/guava/wiki/Release23\n- Changes between 23.0 and 27.0.1:\n  see https://github.com/google/guava/releases\n\njade4j:\n\n- Conditional java/java-devel requires based on os version \n- Update dependency version for commons-lang3 to 3.4\n- Fix building javadoc\n\nkie-api:\n\n- Update KIE to 7.17.0 \n- Release notes: https://issues.jboss.org/secure/ReleaseNote.jspa\n\noptaplanner:\n\n- Update Optaplanner to 7.17.0\n\npy26-compat-salt:\n\n- Fix minion arguments assign via sysctl (bsc#1124290)\n\nsmdba:\n\n- Make 'smdba space-overview' postgresql version\n  agnostic (bsc#1129956)\n- Fix version mismatch\n\nspacecmd:\n\n- Fix system_delete with SSM (bsc#1125744)\n\nspacewalk-admin:\n\n- Fix encoding bug in salt event processing (bsc#1129851)\n\nspacewalk-backend:\n\n- Fix linking of packages in reposync (bsc#1131677)\n- Fix: handle non-standard filenames for comps.xml (bsc#1120242)\n- Mgr-sign-metadata can optionally clear-sign metadata files\n\nspacewalk-branding:\n\n- Introduce a description label for the new 'minion-checkin' Taskomatic job (bsc#1122837)\n\nspacewalk-certs-tools:\n\n- Add support for Ubuntu to bootstrap script\n- Clean up downloaded gpg keys after bootstrap (bsc#1126075)\n\nspacewalk-java:\n\n- Fix base channel selection for Ubuntu systems (bsc#1132579)\n- Fix retrieval of build time for .deb repositories (bsc#1131721)\n- Allow access to susemanager tools channels without res subscription (bsc#1127542)\n- Add support for SLES 15 live patches in CVE audit\n- Add a Taskomatic job to perform minion check-in regularly, drop use of Salt's Mine (bsc#1122837)\n- Fix errata_details to return details correctly (bsc#1128228)\n- Support ubuntu products and debian architectures in mgr-sync\n- Adapt check for available repositories to debian style repositories\n- Add support for custom username when bootstrapping with Salt-SSH\n- Read and update running kernel release value at each startup of minion (bsc#1122381)\n- Add error message on sync refresh when there are no scc credentials\n- Fix apidoc issues \n- Fix deleting server when minion_formulas.json is empty (bsc#1122230)\n- Minion-action-cleanup Taskomatic task: do not clean actions younger than one hour\n- Schedule full package refresh only once per action chain if needed (bsc#1126518)\n- Check and schedule package refresh in response to events independently of what originates them (bsc#1126099)\n- Add configuration option to limit the number of changelog entries added\n  to the repository metadata (fate#325676)\n- Generate InRelease file for Debian/Ubuntu repos when metadata signing is enabled\n\nspacewalk-web:\n\n- Show undetected subscription-matching message object as a string anyway (bsc#1125600)\n- Fix action scheduler time picker prefill when the server is on  'UTC/GMT' timezone (bsc#1121195)\n- Allow username input on bootstrap page when using Salt-SSH\n- Add cache buster for static files (js/css) to fix caching issues after upgrading.\n\nsubscription-matcher:\n\n- Update dependencies (Drools, Optaplanner, Guava, Xstream)\n- Make the java and java-devel requirements variable\n- Relax the requirement condition on apache-commons-lang3\n\nsusemanager:\n\n- Support creating bootstrap repos for Ubuntu 18.04 and 16.04.\n- Allow alternative names for bootstrap packages, to allow\n  using old client tools after package renames\n- Feat: create Ubuntu empty repository\n- Fix creation of bootstrap repositories for SLE12 (no SP) by\n  requiring python-setuptools only for SLE12 \u003e= SP1 (bsc#1129765)\n- Add bootstrap repo definition for SLE15 SP1\n\nsusemanager-docs_en:\n\n- Update text and image files.\n- Fix bad link.\n- Update Manual Backup and smdba sections.\n- Troubleshooting Salt clients.\n- Fix package endpoint in salt pillar content.\n- Ubuntu Clients supported.\n- Change License to GFL 1.2, as it is the real license for the doc\n  since 3.2.0\n\nsusemanager-schema:\n\n- Add a Taskomatic job to perform minion check-in regularly, drop use of Salt's Mine (bsc#1122837)\n- Fix performance regression in inter-server-sync (bsc#1128781)\n- Set minion-action-cleanup run frequency from hourly to daily at midnight\n\nsusemanager-sls:\n\n- Update get_kernel_live_version module to support older Salt versions (bsc#1131490)\n- Update get_kernel_live_version module to support SLES 15 live patches\n- Do not configure Salt Mine in newly registered minions (bsc#1122837)\n- Fix Salt error related to remove_traditional_stack when bootstrapping an Ubuntu\n  minion (bsc#1128724)\n- Automatically trust SUSE GPG key for client tools channels on Ubuntu systems\n- Util.systeminfo sls has been added to perform different actions at minion startup(bsc#1122381) \n\nsusemanager-sync-data:\n\n- Allow access to susemanager tools channels without res subscription (bsc#1127542)\n- Add Ubuntu product definitions\n- Adapt to SCC changes\n- Add CaaSP 4 Toolchain\n\nxstream:\n\n- Update xstream to 1.4.10\n- Major changes:\n- CVE-2017-7957: XStream could cause a Denial of Service when unmarshalling void. (bsc#1070731)\n- New XStream artifact with -java7 appended as version suffix for a library explicitly without the Java 8 stuff (lambda expression support, converters for java.time.* package).\n- Improve performance by minimizing call stack of mapper chain.\n- XSTR-774: Add converters for types of java.time, java.time.chrono, and java.time.temporal packages (converters for LocalDate, LocalDateTime, LocalTime, OffsetDateTime, and ZonedDateTime by Matej Cimbora).\n- JavaBeanConverter does not respect ignored unknown elements.\n- Add XStream.setupDefaultSecurity to initialize security framework with defaults of XStream 1.5.x.\n- Emit error warning if security framework has not been initialized and the XStream instance is vulnerable to known exploits.\n- Feat: modify patch to be compatible with JDK 11 building\n- Fixes for SLE 15 compatibility\n\n","status":"published","published":"2019-04-24T10:06:34Z","modified":"2026-02-04T04:06:27.957159Z","updated_at":"2026-11-02T15:53:45.926331Z"}]}}